Post Type Archive Mapping Vulnerabilities

The Custom Query Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 5.5.0

Fixed in:

5.6.0

Disclosed:

Feb 12, 2026

CVE-2026-39575 on NVD →

[en] Missing Authorization vulnerability in MediaRon LLC Custom Query Blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Custom Query Blocks: from n/a through 5.2.0.

Affected:

up to 5.3.0

Fixed in:

5.3.0

Disclosed:

Nov 1, 2024

CVE-2024-38794 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MediaRon LLC Custom Query Blocks allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.3.1.

Affected:

up to 5.3.1

Fix:

No patched version reported

Disclosed:

Sep 15, 2024

CVE-2024-44059 on NVD →

The Custom Query Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 5.3.1

Fixed in:

5.4.0

Disclosed:

Aug 29, 2024

CVE-2024-44059 on NVD →

The Custom Query Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several REST API in versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to retrieve post data.

CVSS:

5.3

Affected:

up to 5.2.0

Fixed in:

5.3.0

Disclosed:

Jul 22, 2024

CVE-2024-38794 on NVD →